CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
398,558 CVEs
1,726 on KEV
17,267 EPSS ≥ 10%
25,086 with exploits
synced 2026-09-27
10,151 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2008-6132 EXP | Eval injection vulnerability in reserve.php in phpScheduleIt 1.2.10 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to execute… | Patch early | 6.8 medium | 26.1% | 2009-02-13 |
| CVE-2011-2179 EXP | Multiple cross-site scripting (XSS) vulnerabilities in config.c in config.cgi in (1) Nagios 3.2.3 and (2) Icinga before 1.4.1 allow remote attackers t… | Patch early | 4.3 medium | 26% | 2011-06-14 |
| CVE-2019-19368 EXP | A Reflected Cross Site Scripting was discovered in the Login page of Rumpus FTP Web File Manager 8.2.9.1. An attacker can exploit it by sending a craf… | Patch early | 6.1 medium | 25.9% | 2019-12-16 |
| CVE-2000-0830 EXP | annclist.exe in webTV for Windows allows remote attackers to cause a denial of service by via a large, malformed UDP packet to ports 22701 through 227… | Patch early | 5.0 medium | 25.9% | 2000-11-14 |
| CVE-2024-24494 EXP | Cross Site Scripting vulnerability in Daily Habit Tracker v.1.0 allows a remote attacker to execute arbitrary code via the day, exercise, pray, read_b… | Patch early | 6.1 medium | 25.9% | 2024-02-08 |
| CVE-2009-1523 EXP | Directory traversal vulnerability in the HTTP server in Mort Bay Jetty 5.1.14, 6.x before 6.1.17, and 7.x through 7.0.0.M2 allows remote attackers to… | Patch early | 5.0 medium | 25.8% | 2009-05-05 |
| CVE-2006-3081 EXP | mysqld in MySQL 4.1.x before 4.1.18, 5.0.x before 5.0.19, and 5.1.x before 5.1.6 allows remote authorized users to cause a denial of service (crash) v… | Patch early | 4.0 medium | 25.8% | 2006-06-19 |
| CVE-2008-4800 EXP | The DebugDiag ActiveX control in CrashHangExt.dll, possibly 1.0, in Microsoft Debug Diagnostic Tool allows remote attackers to cause a denial of servi… | Patch early | 5.0 medium | 25.8% | 2008-10-31 |
| CVE-2002-1712 EXP | Microsoft Windows 2000 allows remote attackers to cause a denial of service (memory consumption) by sending a flood of empty TCP/IP packets with the A… | Patch early | 5.0 medium | 25.8% | 2002-12-31 |
| CVE-2004-0479 EXP | Internet Explorer 6 allows remote attackers to cause a denial of service (crash) via Javascript that creates a new popup window and disables the image… | Patch early | 5.0 medium | 25.8% | 2004-07-07 |
| CVE-2005-3745 EXP | Cross-site scripting (XSS) vulnerability in Apache Struts 1.2.7, and possibly other versions allows remote attackers to inject arbitrary web script or… | Patch early | 4.3 medium | 25.7% | 2005-11-22 |
| CVE-2005-4703 EXP | Apache Tomcat 4.0.3, when running on Windows, allows remote attackers to obtain sensitive information via a request for a file that contains an MS-DOS… | Patch early | 5.0 medium | 25.7% | 2005-12-31 |
| CVE-2000-0759 EXP | Jakarta Tomcat 3.1 under Apache reveals physical path information when a remote attacker requests a URL that does not exist, which generates an error… | Patch early | 6.4 medium | 25.7% | 2000-10-20 |
| CVE-2004-1560 EXP | Microsoft SQL Server 7.0 allows remote attackers to cause a denial of service (mssqlserver service halt) via a long request to TCP port 1433, possibly… | Patch early | 5.0 medium | 25.6% | 2004-12-31 |
| CVE-2005-2307 EXP | netman.dll in Microsoft Windows Connections Manager Library allows local users to cause a denial of service (Network Connections Service crash) via a… | Patch early | 5.0 medium | 25.6% | 2005-07-19 |
| CVE-2015-6086 EXP | Microsoft Internet Explorer 9 through 11 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Inte… | Patch early | 4.3 medium | 25.6% | 2015-11-11 |
| CVE-2005-0420 EXP | Microsoft Outlook Web Access (OWA), when used with Exchange, allows remote attackers to redirect users to arbitrary URLs for login via a link to the o… | Patch early | 5.8 medium | 25.6% | 2005-04-27 |
| CVE-2006-1626 EXP | Internet Explorer 6 for Windows XP SP2 and earlier allows remote attackers to spoof the address bar and possibly conduct phishing attacks by re-openin… | Patch early | 4.3 medium | 25.5% | 2006-04-05 |
| CVE-2008-2948 EXP | Cross-domain vulnerability in Microsoft Internet Explorer 7 and 8 allows remote attackers to change the location property of a frame via the Object da… | Patch early | 6.8 medium | 25.4% | 2008-06-30 |
| CVE-2008-0095 EXP | The SIP channel driver in Asterisk Open Source 1.4.x before 1.4.17, Business Edition before C.1.0-beta8, AsteriskNOW before beta7, Appliance Developer… | Patch early | 5.0 medium | 25.4% | 2008-01-08 |
| CVE-2015-2746 EXP | The network diagnostics tool (CommandLineServlet) in the Appliance Manager command line utility (CLU) in Websense TRITON 7.8.3 and V-Series appliances… | Patch early | 6.5 medium | 25.4% | 2015-03-26 |
| CVE-2006-7210 EXP | Microsoft Windows 2000, XP, and Server 2003 allows remote attackers to cause a denial of service (cpu consumption) via a PNG image with crafted (1) Wi… | Patch early | 5.0 medium | 25.1% | 2007-06-27 |
| CVE-2017-11906 EXP | Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, and Windows… | Patch early | 5.3 medium | 25.1% | 2017-12-12 |
| CVE-2010-3324 EXP | The toStaticHTML function in Microsoft Internet Explorer 8, and the SafeHTML function in Microsoft Windows SharePoint Services 3.0 SP2, SharePoint Fou… | Patch early | 4.3 medium | 25% | 2010-09-17 |
| CVE-2016-3216 EXP | GDI32.dll in the Graphics component in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 201… | Patch early | 4.3 medium | 25% | 2016-06-16 |
| CVE-2007-1910 EXP | Buffer overflow in wwlib.dll in Microsoft Word 2007 allows remote attackers to cause a denial of service (application crash) and possibly execute arbi… | Patch early | 6.8 medium | 24.9% | 2007-04-10 |
| CVE-2004-0728 EXP | The Remote Control Client service in Microsoft's Systems Management Server (SMS) 2.50.2726.0 allows remote attackers to cause a denial of service (cra… | Patch early | 5.0 medium | 24.8% | 2004-07-27 |
| CVE-2013-2121 EXP | Eval injection vulnerability in the create method in the Bookmarks controller in Foreman before 1.2.0-RC2 allows remote authenticated users with permi… | Patch early | 6.0 medium | 24.8% | 2013-07-31 |
| CVE-2006-3880 EXP | Microsoft Windows NT 4.0, Windows 2000, Windows XP, and Windows Small Business Server 2003 allow remote attackers to cause a denial of service (IP sta… | Patch early | 5.0 medium | 24.7% | 2006-07-27 |
| CVE-2018-4936 EXP | Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable Heap Overflow vulnerability. Successful exploitation could lead to information… | Patch early | 6.5 medium | 24.7% | 2018-05-19 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt